[patch] Segmentation fault when using lftp on web pages

Martin Nagy <[email protected]> Thu, 24 Jan 2008 15:26:37 +0100

Newsgroups	gmane.network.lftp.devel
Message-ID	<[email protected]>

Hi. lftp 3.6.1 will core dump when used on a page that uses empty 
arguments for tags, eg. '<meta content="">'. To reproduce, put attached 
index.html on a web server, then:
$ lftp http://localhost/
cd ok, cwd=/
lftp localhost:/> ls
Segmentation fault
Exit 139

The attached patch fixes the problem, but maybe you'll be able to come 
up with a better one.

Regards,
Martin Nagy

index.html (text/html, 384 B)

<a href="">
<img src="">
<body background="">
<frame src="">
<iframe src="">
<fig src="">
<overlay src="">
<applet code="">
<script src="">
</script>
<embed src="">
<bgsound src="">
<area href="">
<img lowsrc="">
<input src="">
<layer src="">
<table background="">
<th background="">
<td background="">
<base href="">
<meta content="">
<link href="" rev="made">
<link rel="" href="">

lftp-3.6.1-empty_argument.patch (text/x-patch, 816 B)

diff -up lftp-3.6.1/src/HttpDir.cc.empty_content lftp-3.6.1/src/HttpDir.cc
--- lftp-3.6.1/src/HttpDir.cc.empty_content	2007-08-29 13:20:13.000000000 +0200
+++ lftp-3.6.1/src/HttpDir.cc	2008-01-24 14:56:02.000000000 +0100
@@ -729,6 +729,8 @@ static int parse_html(const char *buf,in
       // skip 0; URL=
       link_target.rtrim();
       const char *scan=link_target;
+      if(!scan)
+	 return tag_len;
       while(*scan && is_ascii_digit(*scan))
 	 scan++;
       if(*scan!=';')
@@ -763,7 +765,7 @@ static int parse_html(const char *buf,in
       a_href=true;
 
    // check if the target is a relative and not a cgi
-   if(strchr(link_target,'?'))
+   if(!link_target||strchr(link_target,'?'))
       return tag_len;	// cgi
    link_target.truncate_at('#'); // strip the anchor
    if(link_target.length()==0)